In an era marked by the rapid growth of the Internet of Things (IoT), network security has become increasingly critical. Traditional Intrusion Detection Systems, particularly signature-based methods, struggle to identify evolving cyber threats such as Advanced Persistent Threats (APTs)and zero-day attacks. Such threats or attacks go undetected with supervised machine-learning methods. In this paper, we apply K-means clustering, an unsupervised clustering technique, to a newly created modern network attack dataset, UWF-ZeekDataFall22. Since this dataset contains labeled Zeek logs, the dataset was de-labeled before using this data for K-means clustering. The labeled data, however, was used in the evaluation phase, to determine the attack clusters post-clustering. In order to identify APTs as well as zero-day attack clusters, three different labeling heuristics were evaluated to determine the attack clusters. To address the challenges faced by Big Data, the Big Data framework, that is, Apache Spark and PySpark, were used for our development environment. In addition, the uniqueness of this work is also in using connection-based features. Using connection-based features, an in-depth study is done to determine the effect of the number of clusters, seeds, as well as features, for each of the different labeling heuristics. If the objective is to detect every single attack, the results indicate that 325 clusters with a seed of 200, using an optimal set of features, would be able to correctly place 99% of attacks.

The rapid evolution of cyberattacks, coupled with the increasing capacity of computing environments and the emergence of artificial intelligence (AI), has significantly complicated the security landscape. While existing studies largely emphasize improving AI model performance for individual cybersecurity tasks, this survey shifts the focus toward operationalizing the deployment rationale and understanding when, where, and why different AI paradigms should be deployed, the capabilities they offer; and the challenges that must be addressed to enable trustworthy and effective real-world cyber defense. This paper aims to provide researchers and practitioners with a comprehensive reference for understanding the evolving role of AI in cybersecurity and the challenges that must be addressed to develop trustworthy and resilient AI-driven cyber defense systems. In this paper, we propose a structured taxonomy to organize various dimensions of AI-driven cybersecurity; review them critically; and finally, discuss key challenges, open problems, and emerging trends.